Hazard Analysis¶

Hazard-identification method — instantiates Migration-Resistant Hazard Control

Enumerates the hazards a control leaves behind — including the ones it displaces — and holds each residual against an explicit tolerance rather than against whatever the current design happens to achieve.

Hazard Analysis systematically enumerates the ways a system can cause harm — the hazardous states, the exposure paths, the barriers in place, and, crucially, the residual hazards that remain after those barriers. Its distinguishing contribution in this archetype is a disciplined residual view coupled to an explicit tolerance: it does not stop at "we added a guard," but asks what harm the guard leaves un-addressed — including the harm it moves — records it, and holds it against a stated acceptance criterion rather than against whatever the new design happens to achieve. Where the modelling mechanisms map how a hazard travels, hazard analysis is the inventory-and-acceptance step: the register of what is left over, and the line that says how much left-over is allowed.

Example¶

A distribution centre adds autonomous mobile robots to move pallets and cages the main aisles to keep people clear of them. A hazard analysis works through the system state by state and refuses to close on the cage. Guarding the aisles removes the obvious crush hazard — but the walk-through identifies the residual and displaced hazards the cage creates: workers now cross at unguarded transfer points where robots and pedestrians still mix; maintenance staff enter the cage under a lockout procedure whose failure is now higher-consequence; and pickers, pushed to match the robots' pace, cut through emergency exits. Each residual is logged rather than waved away, and each is judged against an explicit tolerance — no routine task may rely on a single human action to prevent a fatality — not against the comfortable fact that the aisles are now safe. The output is a residual-risk register with an acceptance line drawn through it, showing exactly which leftover hazards must still be driven down.

How it works¶

Work the system state by state. Systematic enumeration, not incident memory, is what surfaces the hazard nobody has been hurt by yet.
Ask what the control leaves and moves. For each barrier, name the residual hazard it does not cover and the new hazard it introduces or displaces.
Set an acceptance criterion first. A tolerance threshold is agreed independent of the current design, so the design is judged against the line rather than the line against the design.
Register the leftovers. Residual hazards are recorded with their owners and their standing against the threshold, forming a living account rather than a one-off sign-off.

Tuning parameters¶

Scope / granularity — per-task walk-through versus whole-system study. Fine grain catches local residuals; a wider frame catches the ones that migrate across the boundary.
Guideword set — the prompts used to provoke hazards (deviation, misuse, failure, displacement). A set that omits "where does the blocked hazard go" cannot find displacement.
Tolerance criterion — how low residual risk must go, and against what (fatality, exposure, cost). The whole method turns on setting this honestly rather than retrofitting it.
Expertise in the room — whose imagination bounds the study. Narrow expertise narrows the hazards that can be seen.
Refresh cadence — one-off assessment or re-run on change. Residual pictures rot as the system and its workarounds evolve.

When it helps, and when it misleads¶

Its strength is that it produces a residual picture with an explicit acceptance line — the difference between "we installed a control" and "here is exactly what the control leaves unhandled, and here is how much of that we are prepared to tolerate." That is what stops a barrier from being scored as a solved problem.

Its failure mode is that it is bounded by the team's imagination: an emergent or cross-boundary hazard nobody thinks to enumerate is implicitly certified as absent, and a study scoped tightly around the acting unit will miss exactly the displaced hazard this archetype cares about. Its classic misuse is to set the tolerance threshold to whatever the current design achieves — retrofitting the acceptance line so every residual conveniently falls under it. The discipline is to fix the tolerance criterion before judging the design, to widen scope past the controlled unit, and to invite external challenge so the register is not just the designers reassuring themselves.^[1]

How it implements the components¶

residual_risk_register — its primary output: the enumerated hazards that remain after controls, each with an owner and a standing.
tolerance_threshold — the explicit acceptance criterion every residual is measured against, agreed independently of the current design.

It does not map where a displaced hazard travels — the transfer path is Fault Tree Analysis and the migration field is Causal Loop Diagram — nor does it measure whether the residuals materialised, which is Before–After–Elsewhere Evaluation.

Instantiates: Migration-Resistant Hazard Control — hazard analysis supplies the residual inventory and the acceptance line the rest of the appraisal works against.
Sibling mechanisms: Fault Tree Analysis · Mass Balance · Causal Loop Diagram · Whole-System Impact Map · Adaptive Circumvention Red Team · Before–After–Elsewhere Evaluation · Agent-Based Experiment or Simulation · System-Wide Net-Risk Dashboard · Boundary Expansion Review · Cross-Boundary Hazard Ledger · Cross-Jurisdiction Incident Review · Intervention Displacement Stress Test · Migration Sentinel Network · Pressure-Absorption Redesign Workshop · Source-Reduction or Safe-Dissipation Plan

References¶

[1] ALARP — "as low as reasonably practicable" — is the principle that residual risk should be driven down until further reduction is grossly disproportionate to the benefit gained. It presupposes an explicit, defensible tolerance threshold rather than "whatever we happened to achieve," which is why the acceptance line must be set independently of the design under review. ↩